skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/ifc-to-excel/Gen Agent Trust Hub
ifc-to-excel
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
IfcExporterCLI binary usingsubprocess.run()inSKILL.md. The implementation correctly uses a list-based argument structure rather than a shell string, which effectively prevents shell injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external IFC files, which serves as an ingestion point for untrusted data.
- Ingestion points: IFC file paths provided to
IFCExporter.convertinSKILL.md. - Boundary markers: No explicit instructions to ignore embedded instructions are present in the processing logic.
- Capability inventory: The skill possesses filesystem write capabilities (via Pandas) and command execution capabilities (via
subprocess.run) as described inSKILL.md. - Sanitization: The skill extracts property values and quantities into structured formats (Excel/DataFrames) but does not specifically sanitize the content of BIM properties that could contain natural language instructions.
Audit Metadata